In short: CyberFOX AutoElevate is privileged access management for Windows that removes standing local admin rights while letting approved tasks run elevated. Requests are handled by rules or approved from a mobile app, and every decision is ticketed. Standard covers removal and approvals; Advanced adds just-in-time admin login, Entra ID sign-on, event logging and living-off-the-land blocking. It is billed per endpoint.
What AutoElevate is
Local administrator rights let a user install software, change security settings and run anything they like. They also let malware do the same. Removing them is one of the most effective security steps an organisation can take, and frameworks such as the CIS Critical Security Controls and NIST guidance on least privilege recommend it. The reason many organisations have not done it is the support burden: suddenly every printer driver, software update and specialist application needs IT to type in a password.
AutoElevate handles that burden. When a user hits a Windows User Account Control (UAC) prompt, the AutoElevate agent checks it against your rules. Known, approved tasks elevate automatically. Anything else becomes a request that a technician can approve or deny from the AutoElevate mobile app, once or as an ongoing rule. Each request creates a ticket with the request, requester, machine, decision, status and outcome, and each response can create a time entry in your PSA.
Standard and Advanced compared
| Feature | Standard | Advanced |
|---|---|---|
| Remove local admin rights | Yes | Yes |
| Rule-based automatic approvals from UAC events | Yes | Yes |
| Approve or deny from the mobile app | Yes | Yes |
| Technician mode with two-factor authentication | Yes | Yes |
| Automatic tickets and PSA time entries | Yes | Yes |
| Just-in-time admin login | No | Yes |
| Microsoft Entra ID single sign-on to the admin portal | No | Yes |
| Granular settings down to individual computers | No | Yes |
| Windows Event Log output for a SIEM | No | Yes |
| Biometric authentication in the mobile app | No | Yes |
| Blocker for living-off-the-land attacks, with custom block and allow rules | No | Yes |
Just-in-time admin creates a temporary local administrator when a technician needs one: the technician scans a QR code on the Windows sign-in screen with the AutoElevate mobile app, so there is no admin password to know or share. CyberFOX supports it on Windows 10 and Windows 11 workstations. Blocker works from a curated list of native Windows applications, binaries and DLLs that attackers abuse; new endpoints start in audit mode so its recommendation engine can suggest safe rules for your environment. CyberFOX may adjust the split between editions, so we confirm it when we quote.
How it is licensed
| Item | How it works |
|---|---|
| Unit | Active agents installed and registered on your devices |
| Technicians | Not charged, so add as many approvers as you need |
| Editions | Standard or Advanced |
| Commitment | A minimum commitment applies; we confirm term and minimum before you order |
| Billing | Monthly, through your Forever Systems account |
Prices depend on the edition and number of agents, so ask us for a quote. For background on device-based licensing see per-user vs per-device licensing.
Requirements and deployment
CyberFOX lists Windows 11, Windows Server 2016, 2019, 2022 and 2025, and Remote Desktop Services, terminal server and VDI environments as supported for the AutoElevate agent. A macOS agent is in early access with CyberFOX and is not yet generally available. The agent is an MSI installer that needs your licence key, company name and location, so it can be pushed silently by an RMM tool, Group Policy or a deployment script. Your antivirus or EDR may need the agent's processes and addresses allowlisting so devices check in reliably. Entra ID single sign-on for administrators is set up from the admin portal; Microsoft requires Entra ID P1 or P2 if you want to assign access by group.
We deploy in stages: install in audit mode, review the elevation requests your users actually make, build rules, then remove admin rights group by group with a clear message to staff.
Who it suits
AutoElevate suits Windows-based organisations that want to remove admin rights without hiring extra helpdesk staff, and IT teams who want every elevation to be approved and recorded. It supports the Cyber Essentials user access control requirement that admin accounts are used only for admin tasks, and it gives clear answers to cyber insurance questions about privileged access. Advanced is worth it if you send logs to a SIEM, want to block living-off-the-land techniques, or need just-in-time admin accounts instead of a shared local admin password.
How we help
We audit current admin rights, deploy the agent, build the rule set and handle the cultural change of removing rights. Requests can come to our technicians, to your IT team or to both, and you get a regular report of what was elevated and why. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does AutoElevate replace LAPS?
It addresses a different problem. LAPS rotates the local admin password; AutoElevate removes the need for users to have admin rights and, on Advanced, creates temporary just-in-time admin accounts so technicians do not need a shared password at all.
What happens if a request arrives out of hours?
Approvers receive requests on the AutoElevate mobile app wherever they are. Common tasks can be covered by rules so they elevate automatically without waiting for anyone.
Does AutoElevate support macOS?
The generally available agent is for Windows desktops, servers and virtual desktops. CyberFOX's macOS agent is in early access, so talk to us before planning a Mac rollout.
Are technicians charged for AutoElevate?
No. Billing is based on active agents on devices, and you can add as many technicians as you need.
Can AutoElevate send events to our SIEM?
Yes, on Advanced. The agent can write its activity, including privileged user actions, to the Windows Event Log, which your log collector can forward to a SIEM.